CVE-2008-0506
Coppermine Photo Gallery < 1.4.14 - Remote Code Execution via ImageMagick Picture Processing Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-0506.
PoCs published by Metasploit, waraxe, Janek Vind, jduck, including Metasploit module exploits/unix/webapp/coppermine_piceditor.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Coppermine Photo Gallery's picEditor.php script when ImageMagick is used. The 'angle' parameter is manipulated to execute arbitrary commands via improper escaping in the 'exec' call.
Description
include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) quality, (2) angle, or (3) clipval parameter to picEditor.php.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in Coppermine Photo Gallery's picEditor.php script when ImageMagick is used. The 'angle' parameter is manipulated to execute arbitrary commands via improper escaping in the 'exec' call.
The exploit demonstrates a remote shell command execution vulnerability in Coppermine Photo Gallery 1.4.14 due to unsanitized user input in the 'angle' POST parameter, allowing arbitrary command execution via ImageMagick's 'convert' command. The PoC includes a crafted HTML form to trigger the vulnerability.
This Metasploit module exploits a command injection vulnerability in Coppermine Photo Gallery's picEditor.php script. The vulnerability arises from improper escaping of user-supplied input in the 'angle' parameter, which is passed to the PHP 'exec' function when ImageMagick is configured.